Subject: Chroot & cgi Help!

From: "Fred B. Ringel" <[email-masked]>
Date: Thu, 27 Mar 1997 23:35:00 -0500 (EST)

Hi all-

	I have the wu.ftpd daemon running on my web server to chroot each
user to their home directory when they ftp their home pages to the server.
Now they all want to set up their own brand of guest-book, and what not. So
I compiled Cgiwrap to protect the server from any really wild/insecure
cgi's.

	They work great from my own (non-chrooted) directory, but will not
run from a users /public_html/cgi-bin directory on the basis that cgi-wrap
complains there is an illegal "." or ".." in the path, the very "." which
causes the chroot to the home directory.

	While I realize this is not 100% on topic for wu-ftpd, I did learn
how to set up the chrooted env from Mike Brennan and figure some of you
must have run into this problem shortly after doing the guest how-to.

	How do I get cgi-wrap and wu-ftpd to co-operate to have users
chroot'ed to their home directories on my apache web server (and no, suexec
didn't work at all), and still be able to run cgi-bins of their own
creation under /home/public_html/cgi-bin. Seems cgi-wrap is a natural
compliment to the chroot idea and they should be compatible.

	It would be great if the collective wisdom on the list could bail
me out here.  I've got a bit or pressure to get this working yesterday. 

	Many Thanks,

	Fred
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
Fred B. Ringel			--	Rivertown.Net Internet Access
Systems Administrator		--	http://www.rivertown.net
and General Fixer Upper		--	Voice/Fax/Support: +1.914.478.2885
	Although in theory, there's no difference between 
	theory and practice, in practice, there is.

---

From: Michael Brennen <[email-masked]>
Date: Mon, 31 Mar 1997 23:13:20 -0600 (CST)

Did you ever get an answer on this?

Sounds like a source hack is in order on cgi-wrap to get it to swallow the
/./ in the /etc/passwd home path.

Yet, something is still not adding up as I understand your description so
far. When you chroot the user in ftp to upload the CGI stuff, the CGI is
not executed at that time.  The cgi-wrap is executed later from the Web
server, no?  What does a chrooted ftp session have to do with Web server
CGI?  Are they running the CGI programs from the ftp login? 

   -- Michael